Cookie Policy

Sitewren uses a small number of cookies, and all of them exist to keep you signed in. There are no advertising cookies, no cross-site tracking pixels and no third-party analytics on this site, which is why you are not being asked to dismiss a consent banner: strictly necessary cookies do not require consent, and we do not set any other kind.

Essential cookies

• sa_access — a short-lived session token that proves who you are on each request. It expires roughly fifteen minutes after it is issued.
• sa_refresh — a longer-lived token that lets your browser renew an expired session without making you type your password again. It lasts up to thirty days, and logging out invalidates it on the server as well as clearing it from your browser.
• sa_admin_access — issued only to administrators signing in to the admin panel. If you are a customer, you will never receive it.

How they are protected

All three are HttpOnly, so JavaScript running in the page cannot read them, which limits what a cross-site scripting bug could steal. They are marked Secure, so they are only ever sent over HTTPS, and SameSite=Lax, so another website cannot cause your browser to send them along with a request it makes on your behalf. They are scoped to our domain and its subdomains, because the marketing site and the dashboard are served from different hostnames and one session has to work across both.

None of them contains your password. The access token is a signed statement that a session exists; the refresh token is a random value whose hash is what we store, so the database never holds anything that could be replayed as a login.

Analytics and advertising

We do not run advertising or profiling cookies of any kind, and we do not sell or share what we hold. Error monitoring is in place so that crashes get fixed, and it is described in the Privacy Policy along with everything else we process. If we ever add privacy-friendly analytics, this page will be updated first and consent requested wherever the law requires it.

Managing cookies

You can clear or block cookies in your browser settings at any time. Blocking the three above will not break the public pages — pricing, the free preview and every legal page work without them — but it will make it impossible to stay signed in to the dashboard, because there is no other mechanism holding your session. Clearing them mid-session simply logs you out.

This policy is reviewed whenever the set of cookies changes, and the date at the top of the page is the last time that happened. Because everything listed here is strictly necessary, a change would mean either a new session mechanism or a new category of cookie entirely — and the second of those would come with a consent prompt, not a quiet edit.

Questions about this policy, or a request to have data deleted: hello@sitewren.co.uk. See also the Privacy Policy and the Terms of Service.